supplier legitimacy